> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truscan.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Your endpoints

> The signing secret is never included. It is returned once, by the create call.



## OpenAPI

````yaml /api-reference/webhooks.json get /api/webhooks
openapi: 3.1.0
info:
  title: truscan webhooks
  version: 1.0.0
  description: >-
    Outbound event delivery. Customers register an endpoint, choose events, and
    receive signed POSTs.


    Every delivery carries `Truscan-Signature: t=<unix>,v1=<hex>`, where the hex
    is HMAC-SHA256 of `<timestamp>.<raw body>` keyed with the endpoint's signing
    secret. The timestamp is inside the signed material, so a captured delivery
    cannot be replayed with a fresh one. Compare with a constant-time function,
    and reject a timestamp outside your tolerance.


    A 2xx marks the delivery done. Anything else is retried at 30s, 2m, 10m, 45m
    and 2h, after which it is abandoned. Return 410 Gone to stop delivery
    permanently.
servers:
  - url: https://api.truscan.co
security:
  - bearerAuth: []
paths:
  /api/webhooks:
    get:
      summary: Your endpoints
      description: >-
        The signing secret is never included. It is returned once, by the create
        call.
      responses:
        '200':
          description: Endpoints, newest first
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Endpoint'
        '401':
          $ref: '#/components/responses/Failure'
components:
  schemas:
    Endpoint:
      type: object
      properties:
        id:
          type: string
          example: whe_9f2c…
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
        enabled:
          type: boolean
        description:
          type: string
        created_at:
          type: string
          format: date-time
  responses:
    Failure:
      description: A handled failure. Never a 200.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              message:
                type: string
              result:
                type: object
                properties:
                  code:
                    type: string
                    example: validation_failed
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: A dashboard session cookie or a tru_ API key.

````